PT-2023-1012 · Sap · Sap Bpc Ms

Published 2023-01-09 · Updated 2023-01-18 · CVE-2023-0016

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BPC MS 10.0 version 810

Description The issue allows an unauthorized attacker to execute crafted database queries, potentially leading to SQL injection. This could enable an attacker to access, modify, and/or delete data from the backend database. The vulnerability is related to the lack of protection measures for the SQL query structure, which could allow a remote attacker to execute arbitrary SQL queries.

Recommendations For SAP BPC MS 10.0 version 810, consider restricting access to the database to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using crafted database queries and ensure proper validation and sanitization of user input to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-00063

CVE-2023-0016

Affected Products

Sap Bpc Ms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-0016 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00063 · Security Note
• https://launchpad.support.sap.com/#/notes/3275391 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0016 · Vendor Advisory
• https://t.me/cibsecurity/56208 · Telegram Post